Malware Analysis Report

2025-01-19 05:37

Sample ID 230214-mcmdvabh8z
Target GooglePlay23Update.apk
SHA256 32bd4e699c237655c164e36c3fe83d1a9c14b5218aa42b82bf962254e804b0a3
Tags
octo banker evasion infostealer ransomware rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

32bd4e699c237655c164e36c3fe83d1a9c14b5218aa42b82bf962254e804b0a3

Threat Level: Known bad

The file GooglePlay23Update.apk was found to be: Known bad.

Malicious Activity Summary

octo banker evasion infostealer ransomware rat trojan

Octo

Octo payload

Makes use of the framework's Accessibility service.

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

Requests dangerous framework permissions

Acquires the wake lock.

Loads dropped Dex/Jar

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

Removes a system notification.

Uses Crypto APIs (Might try to encrypt user data).

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-02-14 10:19

Signatures

Requests dangerous framework permissions

Description Indicator Process Target
Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE N/A N/A
Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE N/A N/A
Allows an application to receive SMS messages. android.permission.RECEIVE_SMS N/A N/A
Allows an application to read SMS messages. android.permission.READ_SMS N/A N/A
Allows an application to send SMS messages. android.permission.SEND_SMS N/A N/A
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE N/A N/A
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-14 10:19

Reported

2023-02-14 10:23

Platform

android-x86-arm-20220823-en

Max time kernel

1329329s

Max time network

132s

Command Line

com.turnthingpcb

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Makes use of the framework's Accessibility service.

Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

banker
Description Indicator Process Target
Framework service call android.content.pm.IPackageManager.getInstalledApplications N/A N/A

Acquires the wake lock.

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/user/0/com.turnthingpcb/cache/ksubalgwyp N/A N/A
N/A /data/user/0/com.turnthingpcb/cache/ksubalgwyp N/A N/A

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Removes a system notification.

evasion
Description Indicator Process Target
Framework service call android.app.INotificationManager.cancelNotificationWithTag N/A N/A

Uses Crypto APIs (Might try to encrypt user data).

ransomware
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.turnthingpcb

Network

Country Destination Domain Proto
N/A 224.0.0.251:5353 udp
US 1.1.1.1:53 android.apis.google.com udp
NL 142.250.179.206:443 android.apis.google.com tcp
US 1.1.1.1:53 infinitedata-pa.googleapis.com udp
US 1.1.1.1:53 www.ip-api.com udp
US 1.1.1.1:53 28fdghhoo11.top udp
US 208.95.112.1:80 www.ip-api.com tcp
US 1.1.1.1:53 24fdghhoo11.top udp
US 1.1.1.1:53 30fdghhoo11.top udp
US 1.1.1.1:53 11fdghhoo11.top udp
US 1.1.1.1:53 29fdghhoo11.top udp
US 1.1.1.1:53 5fdghhoo11.top udp
US 1.1.1.1:53 6fdghhoo11.top udp
US 1.1.1.1:53 3fdghhoo11.top udp
US 1.1.1.1:53 21fdghhoo11.top udp
US 1.1.1.1:53 17fdghhoo11.top udp
US 1.1.1.1:53 4fdghhoo11.top udp
US 1.1.1.1:53 10fdghhoo11.top udp
US 1.1.1.1:53 8fdghhoo11.top udp
US 1.1.1.1:53 android.apis.google.com udp
NL 142.250.179.206:443 android.apis.google.com tcp
US 1.1.1.1:53 4fdghhoo11.top udp
US 1.1.1.1:53 4fdghhoo11.top udp
US 1.1.1.1:53 19fdghhoo11.top udp
US 1.1.1.1:53 15fdghhoo11.top udp
US 1.1.1.1:53 23fdghhoo11.top udp
US 1.1.1.1:53 13fdghhoo11.top udp
US 1.1.1.1:53 25fdghhoo11.top udp
US 1.1.1.1:53 12fdghhoo11.top udp
US 1.1.1.1:53 26fdghhoo11.top udp
US 1.1.1.1:53 20fdghhoo11.top udp
US 1.1.1.1:53 7fdghhoo11.top udp
US 1.1.1.1:53 16fdghhoo11.top udp
US 1.1.1.1:53 14fdghhoo11.top udp
US 1.1.1.1:53 18fdghhoo11.top udp
US 1.1.1.1:53 2fdghhoo11.top udp
US 1.1.1.1:53 27fdghhoo11.top udp
US 1.1.1.1:53 semanticlocation-pa.googleapis.com udp
NL 216.58.214.10:443 semanticlocation-pa.googleapis.com tcp
US 1.1.1.1:53 2fdghhoo11.top udp
US 1.1.1.1:53 2fdghhoo11.top udp
US 1.1.1.1:53 9fdghhoo11.top udp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 1.1.1.1:853 tcp

Files

/data/user/0/com.turnthingpcb/cache/ksubalgwyp

MD5 ce0f96ac96775d8c6e19bd32b397673a
SHA1 6c3e749563fa197ed52f1fdb93ea0fc5f52823af
SHA256 cb69aa68630bb648838bf713f4d3dbf76d0a86bcc0dea6853febe00f9f6ec383
SHA512 0f4bf6b55a323b6ac3e8e86718c37da65cf42e2c7150b1ccb52b1dfd68b7f37bcccfcac47d9ed0be4c4f156ccd83f7864d904192f9f3ff4cb29fbb3d5af681f1

/data/user/0/com.turnthingpcb/cache/ksubalgwyp.x86.flock

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/cache/ksubalgwyp

MD5 ce0f96ac96775d8c6e19bd32b397673a
SHA1 6c3e749563fa197ed52f1fdb93ea0fc5f52823af
SHA256 cb69aa68630bb648838bf713f4d3dbf76d0a86bcc0dea6853febe00f9f6ec383
SHA512 0f4bf6b55a323b6ac3e8e86718c37da65cf42e2c7150b1ccb52b1dfd68b7f37bcccfcac47d9ed0be4c4f156ccd83f7864d904192f9f3ff4cb29fbb3d5af681f1

/data/user/0/com.turnthingpcb/cache/ksubalgwyp

MD5 ce0f96ac96775d8c6e19bd32b397673a
SHA1 6c3e749563fa197ed52f1fdb93ea0fc5f52823af
SHA256 cb69aa68630bb648838bf713f4d3dbf76d0a86bcc0dea6853febe00f9f6ec383
SHA512 0f4bf6b55a323b6ac3e8e86718c37da65cf42e2c7150b1ccb52b1dfd68b7f37bcccfcac47d9ed0be4c4f156ccd83f7864d904192f9f3ff4cb29fbb3d5af681f1

/data/user/0/com.turnthingpcb/cache/oat/ksubalgwyp.cur.prof

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/shared_prefs/main.xml

MD5 f845f8db34fc55972d4d96b3bdfb96e4
SHA1 de5064726878e62992199c49eb18fe1e4cf376d5
SHA256 ebefc400dce200c59b36cad83e060fc5bd2a6c72d6a5054115f17350762e9383
SHA512 5b389abb3fdb302ba0cc5acf709261b3e7cb82c97bc0d57799577e88a0d4a11f8716e1b153aad88e718845b44cd7f80f4aa655894194278f6dd5121ddcb5e56d

/data/user/0/com.turnthingpcb/shared_prefs/main.xml

MD5 d80366726648bd85187c2a22aa3a6edc
SHA1 0dcfa91656d625ad49d754b06caeec68f71fe964
SHA256 0ac193a9d8f45dc1dbd666df098489ea5bbcc2db42b485b8466a551ba1849114
SHA512 31c4910e180fbda00dd882e9e3cd37e85148bda6b7a4b2000d5bea754f6b14ffe1ed0fab9aae22df67a0774ad8af597a1d898ab84e257637386ee5e133e10745

/data/user/0/com.turnthingpcb/app_webview/variations_seed_new

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/app_webview/variations_stamp

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/app_webview/webview_data.lock

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/shared_prefs/WebViewChromiumPrefs.xml

MD5 21223e9184445fe043476484cd8cb1f9
SHA1 2b4813f849121d60ba35eb0889080668bb62c778
SHA256 bb61b7c087c2ae2de93a7740ff75707342940557146366e92b840284cd9446af
SHA512 be21408de0cc643650e5d9ab9057a8f9de88e37fbdc6417cfeba160402ec4cd14fccbc82cbbfd941ecfc0bb3d4056ee61ac199efdc99d647d53e65818835fd48

/data/user/0/com.turnthingpcb/app_webview/Web Data

MD5 dc79f9ce5f3ab5270b33e61119dfc959
SHA1 1844bf222a5144b513dcf2fb50a18c011701c647
SHA256 47e65f4de08deabfd52ecdb8b0a29c61c482188b92c36182e2112ca0a8f4ff65
SHA512 18b8894a7f35df516f423bbdebf1e05ce09eaf4345b139e59e603cadb81f8d1fa20f793438c28e8fd9a64e64f0684223d90ce6f10d3f93cb0c781049a8cff03e

/data/user/0/com.turnthingpcb/app_webview/metrics_guid

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/app_webview/metrics_guid

MD5 edf8295207f937db955481fb0b776163
SHA1 69ce5716de835139d61548c9d8566e46ba644d52
SHA256 4893a919b41739307e4beb315268a8f52ad216443f6518a903adbf20e3536230
SHA512 33201a16c8e9f60b3da55107539f10134801aec44ed96de1f65d458f40ed19944f670f726a9522fba86cabc5723dd08d9c70601375efbc03108c105fb07bd2c2

/data/user/0/com.turnthingpcb/app_webview/Web Data-journal

MD5 05e4d239d503c60ff6853871798f9fd0
SHA1 a6d6aa8b7908b15c702db55316fd53b2efb08c47
SHA256 97161eaaf9e970950567d395903c5a98f14085dbda403b577562b52d2eccf6ad
SHA512 9f27c348d76325d678251381fb4588042e0706e4864e064cac1e6182271284b3fc0fc1018202b0655b522b4348f73d50f4dc73ff3d3bf956a6ac02f80df71dcf

/data/user/0/com.turnthingpcb/app_webview/GPUCache/index

MD5 93027d42b314432c4216e6cfca48b384
SHA1 43448dd8102979c3926828182579691945eedd4e
SHA256 3cda72e67c62e52a342309c44f2cb3b6c1019c7b11822e2f628e48e254e2b41c
SHA512 a52d13cf7f5be196d1e2f135b8a010f80558c5d35e90e7792441d1c976517d55cf1c9587949db69ebef294cc6ef79529a65e7d779964793016efecacd152f70e

/data/user/0/com.turnthingpcb/app_webview/GPUCache/index-dir/temp-index

MD5 95ca1b9c99a9212433d8e04e5101d83d
SHA1 be1cab48b256160ef497a7603bf5ac0cea1b1f71
SHA256 3d90412aed02b02e71f940b5b32e03267eebee9f2e5f9ae7784f85adb1c7f30c
SHA512 8d3e9fa11764a6fb7d09ad139726b1bb6ea0e3e69457785dd15b10d2879529bb6055957ca7ce0d554d031cf7af6c693f915be442d617fe87f2799bf1a71c41a1

/data/user/0/com.turnthingpcb/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/app_webview/GPUCache/index-dir/temp-index

MD5 bcc1db49164bf82c86e5566a6659bf5f
SHA1 d9d31a05a4da730ee8e0e22085118d35fc4993f0
SHA256 6f013401440ec02ef485d63590e3802f0eef21494f1d8dd3431f0db726028d9f
SHA512 fb0200aee24663d5fc56fb7c94f0b657505c2046bd3424066cb0f197c79148815653ea2b744623ad1d197f539ae7fdfcdb9d67bb0b9cc6a7bf44fb62f735c272

Analysis: behavioral2

Detonation Overview

Submitted

2023-02-14 10:19

Reported

2023-02-14 10:23

Platform

android-x64-arm64-20220823-en

Max time kernel

1332930s

Max time network

159s

Command Line

com.turnthingpcb

Signatures

Octo

banker trojan infostealer rat octo

Octo payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Makes use of the framework's Accessibility service.

Description Indicator Process Target
Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId N/A N/A

Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps).

banker
Description Indicator Process Target
Framework service call android.content.pm.IPackageManager.getInstalledApplications N/A N/A

Acquires the wake lock.

Description Indicator Process Target
Framework service call android.os.IPowerManager.acquireWakeLock N/A N/A

Loads dropped Dex/Jar

Description Indicator Process Target
N/A /data/user/0/com.turnthingpcb/cache/ksubalgwyp N/A N/A
N/A /data/user/0/com.turnthingpcb/cache/ksubalgwyp N/A N/A

Reads information about phone network operator.

Requests disabling of battery optimizations (often used to enable hiding in the background).

evasion
Description Indicator Process Target
Intent action android.settings.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS N/A N/A

Uses Crypto APIs (Might try to encrypt user data).

ransomware
Description Indicator Process Target
Framework API call javax.crypto.Cipher.doFinal N/A N/A

Processes

com.turnthingpcb

Network

Country Destination Domain Proto
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 android.apis.google.com udp
GB 216.58.208.110:443 android.apis.google.com tcp
US 1.1.1.1:53 growth-pa.googleapis.com udp
NL 172.217.168.202:443 growth-pa.googleapis.com tcp
GB 216.58.208.106:443 growth-pa.googleapis.com tcp
NL 142.251.36.10:443 growth-pa.googleapis.com tcp
N/A 224.0.0.251:5353 udp
NL 142.250.179.138:443 growth-pa.googleapis.com tcp
US 1.1.1.1:53 infinitedata-pa.googleapis.com udp
NL 142.251.36.10:443 infinitedata-pa.googleapis.com tcp
US 1.1.1.1:53 11fdghhoo11.top udp
US 1.1.1.1:53 13fdghhoo11.top udp
US 1.1.1.1:53 www.ip-api.com udp
US 1.1.1.1:53 29fdghhoo11.top udp
US 1.1.1.1:53 14fdghhoo11.top udp
US 1.1.1.1:53 30fdghhoo11.top udp
US 1.1.1.1:53 ssl.google-analytics.com udp
US 1.1.1.1:53 3fdghhoo11.top udp
US 1.1.1.1:53 5fdghhoo11.top udp
US 1.1.1.1:53 15fdghhoo11.top udp
US 1.1.1.1:53 21fdghhoo11.top udp
US 1.1.1.1:53 2fdghhoo11.top udp
US 1.1.1.1:53 24fdghhoo11.top udp
US 1.1.1.1:53 4fdghhoo11.top udp
US 1.1.1.1:53 12fdghhoo11.top udp
US 1.1.1.1:53 26fdghhoo11.top udp
US 1.1.1.1:53 16fdghhoo11.top udp
US 1.1.1.1:53 7fdghhoo11.top udp
US 1.1.1.1:53 18fdghhoo11.top udp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 android.apis.google.com udp
US 1.1.1.1:53 12fdghhoo11.top udp
US 1.1.1.1:53 20fdghhoo11.top udp
US 1.1.1.1:53 7fdghhoo11.top udp
US 1.1.1.1:53 17fdghhoo11.top udp
US 1.1.1.1:53 android.apis.google.com udp
NL 142.250.179.206:443 android.apis.google.com tcp
US 1.1.1.1:53 17fdghhoo11.top udp
US 1.1.1.1:53 18fdghhoo11.top udp
US 1.1.1.1:53 23fdghhoo11.top udp
US 1.1.1.1:53 28fdghhoo11.top udp
US 1.1.1.1:53 30fdghhoo11.top udp
US 1.1.1.1:53 27fdghhoo11.top udp
US 1.1.1.1:53 10fdghhoo11.top udp
US 1.1.1.1:53 28fdghhoo11.top udp
US 1.1.1.1:53 8fdghhoo11.top udp
US 1.1.1.1:53 6fdghhoo11.top udp
US 1.1.1.1:53 9fdghhoo11.top udp
US 1.1.1.1:53 19fdghhoo11.top udp
US 1.1.1.1:53 28fdghhoo11.top udp
US 1.1.1.1:53 21fdghhoo11.top udp
US 1.1.1.1:53 25fdghhoo11.top udp
US 1.1.1.1:53 14fdghhoo11.top udp
US 1.1.1.1:53 7fdghhoo11.top udp
US 1.1.1.1:53 18fdghhoo11.top udp
US 1.1.1.1:53 19fdghhoo11.top udp
US 1.1.1.1:53 21fdghhoo11.top udp
US 1.1.1.1:53 25fdghhoo11.top udp
US 1.1.1.1:53 25fdghhoo11.top udp
US 1.1.1.1:53 25fdghhoo11.top udp
US 1.1.1.1:53 9fdghhoo11.top udp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 1.1.1.1:53 28fdghhoo11.top udp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 1.1.1.1:53 ssl.google-analytics.com udp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp
US 198.11.179.3:443 9fdghhoo11.top tcp

Files

/data/user/0/com.turnthingpcb/cache/ksubalgwyp

MD5 ce0f96ac96775d8c6e19bd32b397673a
SHA1 6c3e749563fa197ed52f1fdb93ea0fc5f52823af
SHA256 cb69aa68630bb648838bf713f4d3dbf76d0a86bcc0dea6853febe00f9f6ec383
SHA512 0f4bf6b55a323b6ac3e8e86718c37da65cf42e2c7150b1ccb52b1dfd68b7f37bcccfcac47d9ed0be4c4f156ccd83f7864d904192f9f3ff4cb29fbb3d5af681f1

/data/user/0/com.turnthingpcb/cache/ksubalgwyp

MD5 ce0f96ac96775d8c6e19bd32b397673a
SHA1 6c3e749563fa197ed52f1fdb93ea0fc5f52823af
SHA256 cb69aa68630bb648838bf713f4d3dbf76d0a86bcc0dea6853febe00f9f6ec383
SHA512 0f4bf6b55a323b6ac3e8e86718c37da65cf42e2c7150b1ccb52b1dfd68b7f37bcccfcac47d9ed0be4c4f156ccd83f7864d904192f9f3ff4cb29fbb3d5af681f1

/data/user/0/com.turnthingpcb/cache/ksubalgwyp

MD5 ce0f96ac96775d8c6e19bd32b397673a
SHA1 6c3e749563fa197ed52f1fdb93ea0fc5f52823af
SHA256 cb69aa68630bb648838bf713f4d3dbf76d0a86bcc0dea6853febe00f9f6ec383
SHA512 0f4bf6b55a323b6ac3e8e86718c37da65cf42e2c7150b1ccb52b1dfd68b7f37bcccfcac47d9ed0be4c4f156ccd83f7864d904192f9f3ff4cb29fbb3d5af681f1

/data/user/0/com.turnthingpcb/cache/oat/ksubalgwyp.cur.prof

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/shared_prefs/main.xml

MD5 f845f8db34fc55972d4d96b3bdfb96e4
SHA1 de5064726878e62992199c49eb18fe1e4cf376d5
SHA256 ebefc400dce200c59b36cad83e060fc5bd2a6c72d6a5054115f17350762e9383
SHA512 5b389abb3fdb302ba0cc5acf709261b3e7cb82c97bc0d57799577e88a0d4a11f8716e1b153aad88e718845b44cd7f80f4aa655894194278f6dd5121ddcb5e56d

/data/user/0/com.turnthingpcb/shared_prefs/main.xml

MD5 6ca7f0f701782fcebd8127b78313953f
SHA1 9245a9f7a06852c92a80dc121b5683956ba896db
SHA256 1e7693f2fff0c312ccf0e8710385bbf917698ec11a9b18dee5ec4a1bf6bca882
SHA512 67bcac6b260a283fd17ba6532d0ad507118e2edd0f50f4c8335f09f3a85ddd649bfbf1ce319f243dc55a66fa64b746f6dc505a7c577bd7262baf162668c354fa

/data/user/0/com.turnthingpcb/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/data/user/0/com.turnthingpcb/kl.txt

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e